Help companies prove what they claim
Sudory reads a company's systems every day and turns the readings into evidence against ISO 27001, SOC 2, NIS2 and DORA. We are a small team with a first pilot customer live, and we are hiring for two roles.
Two roles, open now
Both are the first of their kind at Sudory. No salary bands on this page, no start dates: those are a conversation, and we have it early.
01
Compliance lead
You decide what counts as evidence. Every control in our catalog carries a verbatim proof from its source, every check an auditor-facing description of what it reads and why that satisfies the control. You write them, you defend them, and you sit on the customer's side of their audit.
Apply for this roleWhat you will do
- Own the mapping of ISO 27001, SOC 2, NIS2 and DORA onto our shared control library, with the source text as the proof of every edge.
- Write the auditor-facing description of every check: what the scanner reads, what the reading proves, what it cannot prove.
- Run Sudory's own ISO 27001 preparation inside Sudory, the way we ask our customers to.
- Sit with our pilot customers when their auditor asks where a reading came from.
What you bring
- ISO 27001 as a lead implementer or an auditor. You have sat on both sides of the table.
- The Dutch market, and Dutch, are a plus.
- You write precisely and you are comfortable telling an engineer that a reading does not prove what they think it proves.
02
Machine learning engineer, Ingest
Sudory Ingest turns a law or a standard into testable controls: provisions are segmented, classified, normalised and clustered into the same measure across acts. Four EU acts are through it today. You own the pipeline and, above all, its evaluation.
Apply for this roleWhat you will do
- Own the classifiers: multi-label over legal provisions (obligation, scope, exception, enforcement), with per-label thresholds that are defended by numbers.
- Own the evaluation: gold sets, blind human labels, held-out scores. A model ships when the gate says so, not when it feels right.
- Cluster the same requirement across acts without over-merging, and make the clusters reviewable by a human.
- Keep the rule that agents propose and never decide: deterministic first, a model where it earns its place.
What you bring
- Applied NLP or machine learning with an evaluation habit. You have shipped a classifier whose mistakes someone else had to live with.
- TypeScript. The pipeline is TypeScript, and you will be reading and writing it, not only notebooks.
- Legal text does not scare you. EU regulation or standards work is a plus, not a requirement.
How we work
Four things that are true today and that you should want before you write to us.
Evidence first
Everything we claim can be pointed at. The same rule applies inside: a decision comes with the reading that justifies it, and a hunch is labelled as one.
Small and early
You join before the tenth person. The function you join is the function you shape, and the founders are one message away.
Agents in the loop
We build with AI agents every day, and we hold them to the same standard: they propose, a person decides, and what ships is tested.
Remote, in Europe
A small team across Europe, working in the open with each other. We meet in person a few times a year.
How to apply
One email, the role in the subject. Send what you have built or audited and why it mattered, in your own words. No cover letter, no form. Every application gets an answer from a founder.
Write to
contact@sudory.com